CVE-2026-93683: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Fast Datapath for RHEL 10

The vulnerability in Red Hat Fast Datapath for RHEL 10 involves a TOCTOU race condition in the DPDK vhost library's handling of virtio indirect descriptor tables. The host reads the descriptor table length multiple times from guest memory and allocates a host copy before validating the length. If a guest changes the length between these reads or provides an out-of-range next index on a small host copy in the vDPA relay path, the host vhost process may walk beyond the validated memory mapping or heap copy. This can cause the vhost process to crash or become disrupted. Out-of-bounds bytes are consumed as descriptor fields for guest physical address translation and are not returned to the guest as payload. This vulnerability is a residual issue from the non-contiguous indirect descriptor copy path introduced during the fix for CVE-2018-1059.

The vulnerability can cause denial of service by crashing or disrupting the host vhost process handling virtio indirect descriptor tables. It does not directly impact confidentiality or integrity but affects availability. The CVSS score of 6.4 reflects a medium severity with local attack vector, high attack complexity, low privileges required, no user interaction, and a scope change. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93683 for current remediation guidance. No explicit patch or workaround information is provided in the available data. Until a fix is applied, limiting untrusted guest access to the vhost process may reduce risk.